- Drupal patched two remote code execution flaws, CVE-2026-108097 in core and CVE-2026-108099 in the Entity List module, and said exploits might be developed within hours or days.
- Drupal says core alone cannot be used to exploit CVE-2026-108097. Contributed modules and custom code create the attack paths, so exposure differs from site to site.
- Update core to 10.6.19, 11.3.19 or 11.4.10, and Entity List to 3.0.10. If you cannot, uninstall the field_ui module.
Your risk is in the combination, not the product
We usually describe software risk as a property of a product. Drupal's latest advisories show it is also a property of a combination. Drupal says the flaw in its core cannot be exploited by core alone. Whether a site can be attacked depends on what else is installed.
The lesson here is that a product name and version alone do not settle your exposure. Your own build matters too. A team that cannot list its modules and custom code cannot say whether it is exposed.
What Drupal disclosed
Drupal patched two remote code execution flaws, as reported by BleepingComputer on October 17. Remote code execution means an attacker can run commands on your server from afar. One flaw, CVE-2026-108097, is in the Field UI module in Drupal core. The other, CVE-2026-108099, is in Entity List, a contributed module for building entity lists without Views.
Drupal's security team said all currently supported versions of core are affected. Earlier in the week it warned that "exploits might be developed within hours or days" after disclosure. It also asked administrators to be on the latest patch release of their version before October 14, so that the security update would be the only change left to make.
How the exposure works
The advisory for CVE-2026-108097 says core alone cannot be used to exploit it. Contributed modules can provide several routes in, including at least one that needs no login. Custom code may also expose the vulnerable function.
CVE-2026-108099 depends on surrounding code in the same way. An attacker needs a contributed module or custom code to work through. Drupal knows of at least one such route that skips the login step. In plain terms, the flaw is a loaded part, and your site's add-ons decide whether an attacker can reach it.
The report does not explain the flaws' internals. It also does not say that attacks have been seen. The warning is about speed, not about observed exploitation.
Who has to act, and with what
Drupal is popular with government agencies, universities and non-profits, according to the report. Drupal's security team asked administrators to "reserve time for core updates" around the disclosure. For any team with limited capacity, that means moving other work aside at short notice.
Drupal released fixed core builds for three lines: 10.6.19, 11.3.19 and 11.4.10. Teams should take the one that fits the line they run. Separately, move the Entity List module to 3.0.10. Drupal says anything before 10.6.x, and Drupal 11 before 11.3.x, has reached end of life. Those sites need a version upgrade first. Drupal 12 pre-releases before beta2 are affected too, though they are not meant for production. The stable 12.0 release will include the fixes.
For sites that cannot update yet, Drupal advises uninstalling the core Field UI module (field_ui). It also notes that Drupal Steward blocks some known attack routes but not every possible exploit.
What WebPulse data adds
WebPulse scanned the Tranco top 10,000 domains in September 2026. A platform was detected on 2,491 sites, and Drupal was one of them 188 times. That is a sample of popular sites, not a count of Drupal installs. It also does not show which sites run the affected modules.
As background only, WebPulse's NIST NVD profile for Drupal shows 8 entries in the CISA Known Exploited Vulnerabilities catalog across the project's history. The report does not say these two flaws are in that catalog.
Questions to put to your team this week
Which Drupal version do we run, and is it on a supported branch? Is Entity List installed, and is it at 3.0.10? Which contributed modules and custom code touch the affected functions? Do we need Field UI in production, or can we remove it now? If we rely on Drupal Steward, have we confirmed what it does not cover?
A patch only closes a flaw you know you have. The harder job is knowing what your site is made of.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: BleepingComputer.
